[LTP] [PATCH STAGING v4 14/16] fchroot11: test failfs entry with no_new_privs

[Cyril Hrubis]

Hi!
> Verify that an unprivileged process may enter failfs when it
> committed to no_new_privs, since setuid binaries then pose no
> confused deputy risk anymore. The test also verifies that a process
> which entered failfs counts as chrooted: it can no longer create a
> user namespace with unshare() to regain CAP_SYS_CHROOT.
> 
> Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
> ---
>  runtest/staging                               |  1 +
>  testcases/kernel/syscalls/fchroot/.gitignore  |  1 +
>  testcases/kernel/syscalls/fchroot/fchroot11.c | 70 +++++++++++++++++++++++++++
>  3 files changed, 72 insertions(+)
> 
> diff --git a/runtest/staging b/runtest/staging
> index 9ec2a7897..137e3f99a 100644
> --- a/runtest/staging
> +++ b/runtest/staging
> @@ -10,3 +10,4 @@ fchroot07 fchroot07
>  fchroot08 fchroot08
>  fchroot09 fchroot09
>  fchroot10 fchroot10
> +fchroot11 fchroot11
> diff --git a/testcases/kernel/syscalls/fchroot/.gitignore b/testcases/kernel/syscalls/fchroot/.gitignore
> index 53a1fa1d0..650ef2690 100644
> --- a/testcases/kernel/syscalls/fchroot/.gitignore
> +++ b/testcases/kernel/syscalls/fchroot/.gitignore
> @@ -9,3 +9,4 @@ fchroot07_child
>  fchroot08
>  fchroot09
>  fchroot10
> +fchroot11
> diff --git a/testcases/kernel/syscalls/fchroot/fchroot11.c b/testcases/kernel/syscalls/fchroot/fchroot11.c
> new file mode 100644
> index 000000000..85401e5fe
> --- /dev/null
> +++ b/testcases/kernel/syscalls/fchroot/fchroot11.c
> @@ -0,0 +1,70 @@
> +// SPDX-License-Identifier: GPL-2.0-or-later
> +/*
> + * Copyright (C) 2026 SUSE LLC Andrea Cervesato <andrea.cervesato@suse.com>
> + */
> +
> +/*\
> + * Test unprivileged :manpage:`fchroot(2)` into failfs with no_new_privs
> + * set.
> + *
> + * An unprivileged process may enter failfs when it committed to
> + * no_new_privs, since setuid binaries then pose no confused deputy risk
> + * anymore. The test also verifies that a process which entered failfs
> + * counts as chrooted: it can no longer create a user namespace with
> + * :manpage:`unshare(2)` to regain ``CAP_SYS_CHROOT``.
> + *
> + * The user namespace check requires ``CONFIG_USER_NS``, which is enforced
> + * with ``.needs_kconfigs``.
> + *
> + * Root is required to drop to an unprivileged user in the forked child.
> + */
> +
> +#define _GNU_SOURCE
> +#include <fcntl.h>
> +#include <pwd.h>
> +#include <sched.h>
> +#include "tst_test.h"
> +#include "lapi/fcntl.h"
> +#include "lapi/prctl.h"
> +#include "lapi/sched.h"
> +#include "lapi/syscalls.h"
> +
> +static struct passwd *ltpuser;
> +
> +static void run(void)
> +{
> +	if (SAFE_FORK())
> +		return;
> +
> +	SAFE_SETRESUID(ltpuser->pw_uid, ltpuser->pw_uid,
> +		ltpuser->pw_uid);
> +
> +	SAFE_PRCTL(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
> +
> +	TST_EXP_PASS(tst_syscall(__NR_fchroot, FD_FAILFS_ROOT, 0),
> +		"unprivileged fchroot() with no_new_privs");
> +
> +	TST_EXP_FAIL2(open("/etc/passwd", O_RDONLY), EOPNOTSUPP,
> +		"absolute lookup after entering failfs");

AFAIK there is no /etc/passwd on Android. Maybe we should use /dev/zero
instead?

> +	TST_EXP_FAIL(unshare(CLONE_NEWUSER), EPERM,
> +		"user namespace creation blocked by the failfs root");
> +
> +	exit(0);

Here as well, no need for the exit(0).

> +}
> +
> +static void setup(void)
> +{
> +	ltpuser = SAFE_GETPWNAM("nobody");
> +}
> +
> +static struct tst_test test = {
> +	.setup = setup,
> +	.test_all = run,
> +	.needs_root = 1,
> +	.forks_child = 1,
> +	.needs_kconfigs = (const char *[]) {
> +		"CONFIG_USER_NS=y",
> +		NULL,
> +	}
> +};
> 
> -- 
> 2.51.0
> 
> 
> -- 
> Mailing list info: https://lists.linux.it/listinfo/ltp

-- 
Cyril Hrubis
chrubis@suse.cz